Shannon releases v3.0.0 five days after its third minor

KeygraphHQ pushed Shannon, its AI pentesting agent, to v3.0.0 on September 2. That's five days after v2.7.0, the third of three minor releases posted August 26 through 28. The AGPL-3.0 TypeScript project reads source code, picks an attack vector, and fires the exploit against real web apps and APIs, per Shannon's GitHub releases.

That distinction matters for anyone running Shannon ahead of a deploy. A false pass here means an exploit attempt failed against real code rather than a pattern going unflagged. The project has 47,584 stars against just 34 open issues, a small backlog for four releases in a week.

The release notes don't break down what changed across the four tags. It isn't clear how much is bug fixes and how much is new capability.

Firing real exploits at a company's app needs the same environment isolation as a contracted pentester, not a linter running in CI.